Blahalla

A Vault with a Heap-View: The Uncomfortable Space Between AgentCore Harness and Identity

unit42.paloaltonetworks.com · a month ago

Analysis of how default configurations in AWS AgentCore Harness allow prompt injection to exfiltrate credentials, and key steps to secure your agents.

Brevo Supply Chain Attack Injects Malware Into 100,000 Websites

www.securityweek.com · a month ago

Hackers used a compromised API key to deploy a Cloudflare worker that injected malicious scripts.

Researchers Find Security Risks in 73.6% of 61,500 Abandoned IoT Apps

gbhackers.com · a month ago

Researchers have identified significant security and privacy risks across 61,500 abandoned Android Internet-of-Things (IoT) companion applications. Their study found that 73.6% of these apps contained at least one potential vulnerability, risky embedded resource, or insecure communication path.

New Check Point flaw lets hackers execute code with root privileges

www.bleepingcomputer.com · a month ago

Check Point Software has released security updates to address a critical vulnerability that can let attackers execute code with root privileges on management systems.

Critical pgAdmin Authentication Bypass Lets Attackers Login as Administrator Without Credentials

gbhackers.com · a month ago

A critical vulnerability in pgAdmin 4 could allow unauthenticated remote attackers to impersonate arbitrary users, including existing administrator accounts, by supplying a malicious HTTP identity header. This vulnerability, tracked as CVE-2026-86863, affects installations using pgAdmin’s Webserver authentication mode and has a CVSS 3.1 score of 9.8 out of 10.

Plugin4Shell Zero-Click RCE Hits Claude Code, Codex, Copilot and Gemini CLI

gbhackers.com · a month ago

A newly disclosed vulnerability known as Plugin4Shell reveals a supply chain weakness in major AI coding agents. This flaw allows attackers to replace trusted, SHA-pinned plugins with malicious code, enabling remote code execution without user interaction.

Claimed Bug Bounty Hunter Likely Used LLM to Build PhantomRaven npm Stealer

thehackernews.com · a month ago

A financially motivated threat actor has been linked to the development and distribution of a JavaScript (JS)-based information stealer known as PhantomRaven via the npm package registry. "The developer likely wrote the malware using a large language model (LLM), an assessment made with high confidence based on verbose comments, placeholder code, and statistical token-analysis patterns,"

Hackers Exploit MikroTik Vulnerabilities to Take Over MikroTik Routers Without Authentication

gbhackers.com · a month ago

Attackers are actively exploiting a critical vulnerability chain dubbed MikroTrick to seize full administrative control of internet-exposed MikroTik RouterOS devices without valid credentials. CERT Polska disclosed six RouterOS vulnerabilities on September 5, 2026, warning that two critical vulnerabilities could be chained to take over publicly reachable routers.

As Big Tech Takes Over Hollywood, the Picture Onscreen Gets Darker

www.nytimes.com · a month ago

“The Social Reckoning” and other movies reflect growing discontent with Silicon Valley founders. But such films may be at the mercy of the companies themselves.

They hacked a TikTok user’s camera, with help from free AI

www.washingtonpost.com · a month ago

Chinese AI models given away free have potent cybersecurity skills, widening access to high-level hacking knowledge that can be used for good or ill.

Critical Orkes Conductor Vulnerability Exploited in Attacks

www.securityweek.com · a month ago

CVE-2026-58138 is an unauthenticated remote code execution vulnerability that attackers can exploit via inline workflow definitions.

Strong fundamentals make next-gen security possible

www.csoonline.com · a month ago

Risk management has always been a difficult job, but the current threat landscape has taken the challenge to a new level. I’ve spent years leading cybersecurity efforts at large enterprises, including Hyatt and United Airlines, and in that time I’ve seen cybercriminals grow increasingly creative, leveraging innovative tactics and technology to further their efforts.

12 Best Multi-Cloud Security Platforms Compared (2026): Features & Pricing

gbhackers.com · a month ago

Quick Answer: Multi-cloud doesn’t just triple your attack surface it triples your billing surface, and vendors price the same workload differently per provider. Wiz and Prisma Cloud sell one-contract parity; Microsoft publishes rates that now extend to AWS/GCP connectors; Fortinet and Check Point bundle into fabric ELAs; Aviatrix bills the network layer everyone else ignores.

12 Best CDR Solutions Compared (2026): Features & Pricing

gbhackers.com · a month ago

Quick Answer: Cloud detection has a real free floor Falco (OSS, on this list in its own right) plus usage-priced native services (GuardDuty-class) so paid CDR must justify itself on correlation and response speed. CrowdStrike, Wiz, and Palo Alto bill CDR inside platform units; Sysdig monetizes the Falco lineage; specialists Permiso (identity), Stream.

12 Best SSPM Tools Compared (2026): Features & Pricing

gbhackers.com · a month ago

Quick Answer: SSPM bills two ways per employee (predictable, punishes big headcount) or per connected app (bounded, punishes SaaS sprawl) and your estate’s shape decides which is cheaper.

A quartet of Linux local root vulns: DirtyAH6, PPPoEject, TUNderflow, and DiagSpill

heyitsas.im · a month ago

CVE-2026-80844, CVE-2026-81000, CVE-2026-68121 and CVE-2026-74469.

WordPress 7.1.1 Fixes 11 Security Flaws Including Stored XSS and Path Traversal

gbhackers.com · a month ago

WordPress has released version 7.1.1, a maintenance and security update that addresses 11 vulnerabilities affecting core platform components, themes, REST API functionality, comments, XML-RPC, and plugin management.

Microsoft fixes broken copy and paste for Excel 2016 users

www.bleepingcomputer.com · a month ago

Microsoft has fixed a known issue that causes copy-and-paste failures for some Excel users after installing the September 2026 KB5002914 security update.

MIND Secures $72 Million for AI-Powered DLP

www.securityweek.com · a month ago

The company will use the funding to accelerate platform development and expand its presence in key enterprise markets.

Check Point, Kaspersky, Tanium Patch Product Vulnerabilities

www.securityweek.com · a month ago

Check Point Security Management and Log Servers are affected by a critical vulnerability that can allow remote code execution with root privileges.

AI Agent Breaches Spanish Organization, Modifies Personal Data

www.darkreading.com · a month ago

AI-driven cyberattacks used to be exotic. Soon, it'll be odd if threat actors aren't using agents to do all of their bidding.

Scammers Tell T-Mobile Users Their Rewards Are Expiring to Trick Them Into Clicking Phishing Links

gbhackers.com · a month ago

A large-scale SMS phishing campaign is impersonating T-Mobile and warning recipients that their “rewards points” are about to expire, using fabricated balances, urgent deadlines, and lookalike redemption links to steal sensitive information.

RatHat Android Malware Abuses ADB to Retain Shell Access After Uninstall

thehackernews.com · a month ago

Cybersecurity researchers have flagged a new Android malware called RatHat that's assessed to be operated by China-based threat actors and features an artificial intelligence (AI)-powered system to navigate and control compromised devices.

Hackers Turn Brevo Widgets Into Malware Delivery Channel Across 100,000+ Websites

gbhackers.com · a month ago

A suspected supply-chain compromise involving Brevo has exposed visitors and WordPress administrators across more than 100,000 websites to malware. Attackers allegedly abused Brevo-hosted JavaScript assets, signup forms, unsubscribe pages and chat widgets to distribute a WordPress backdoor and ClickFix social-engineering payloads.

AI Malware Keeps Changing Its Code to Break Traditional Signature-Based Detection

gbhackers.com · a month ago

AI-powered malware is beginning to erode one of endpoint security’s oldest assumptions: that malicious code will remain stable long enough to identify, fingerprint, and block.

FBI Seizes NightmareStresser DDoS-for-Hire Domains Used in Hundreds of Thousands of Attacks

gbhackers.com · a month ago

The FBI has seized internet domains linked to NightmareStresser, a long-standing distributed denial-of-service (DDoS)-for-hire platform allegedly used to launch hundreds of thousands of attacks or attempted attacks worldwide since 2022. The U.S.

MovieReaper Malware Spreads Through Pirated Movie Torrents and Uses Solana for C2

gbhackers.com · a month ago

A newly identified Windows malware framework dubbed MovieReaper is being distributed through pirated movie torrents after threat actors compromised a public torrent-file repository used by multiple tracker sites.

OpenAI Reveals AI Models Concealing Mistakes, Using Exposed API Keys and Sharing Files

gbhackers.com · a month ago

OpenAI has introduced a new framework for reporting model misalignment after discovering instances where its AI systems concealed mistakes, accessed exposed API keys, fabricated data, uploaded files without authorization, and communicated through unintended channels. The company released six initial reports detailing behaviors observed during model training and evaluation.

Steam Windows Vulnerability Lets Users Escalate Privileges to NT AUTHORITY\SYSTEM

gbhackers.com · a month ago

A newly published proof of concept called “BrokenPipe” has revealed a local privilege escalation vulnerability in the Steam Client Service on Windows systems. According to the project’s GitHub repository, this flaw could allow a standard, non-administrative Windows user to make the Steam Client Service launch an executable with NT AUTHORITY\SYSTEM privileges.

How Pentest Companies Adapt In The Era of AI

gbhackers.com · a month ago

Every penetration testing firm is facing the same pressure right now. AI tools are faster, cheaper, and increasingly capable, and testers are using them whether the company has a policy on it or not.

Anthropic says its chatbot Claude is taking over the work of building its own successor

www.washingtonpost.com · a month ago

The company said Claude leads 26 percent of its research and development, an indicator of progress toward AI that builds itself without human help.

Inside Microsoft and OpenAI, Worry About Damaging the Publishing Industry

www.nytimes.com · a month ago

Newly unsealed court documents show Microsoft employees discussing whether OpenAI was involved in the “largest theft of labor in human history.

Inside the Modern SOC: Defending the Cross-Environment Pivot

unit42.paloaltonetworks.com · a month ago

Cross-environment attacks demand a new approach to security operations. Learn how Unit 42 Managed XSIAM helps SOC teams investigate complete attack paths.

New RatHat Android malware uses AI to automate device control

www.bleepingcomputer.com · a month ago

A new Android malware called RatHat has been discovered, targeting users with an AI-powered subsystem that helps operators remotely navigate compromised devices.

CISA Ditches Weekly Vulnerability Roundups for Risk-Based Focus

www.darkreading.com · a month ago

The move is consistent with the agency's advice on the need for organizations to prioritize the vulnerabilities that actually matter.

Cisco patches max-severity ISE flaw, the second critical zero-day this week

www.csoonline.com · a month ago

Cisco released patches for an actively exploited authentication bypass vulnerability in its Cisco Identity Services Engine (ISE) platform, which is used for enterprise network access control and policy enforcement. This is the second zero-day flaw Cisco has been forced to release emergency patches for this week, after fixing a critical vulnerability in its Secure Email Gateway appliance.

Senator blocks bill meant to lower electricity prices linked to data centers

www.washingtonpost.com · a month ago

Sen. Martin Heinrich (D-New Mexico) halted passage of a proposal that had passed the House by an overwhelming margin.

‘Crashout’, ‘Looksmaxxing’: Merriam-Webster adds over 1,400 new words

www.washingtonpost.com · a month ago

This slew of terms may be new to the dictionary, but they probably already sound familiar to you.

The Information Wars: A Retrospective

thecarrierwave.substack.com · a month ago

Interesting commentary on what information operations looks like from the government side.

China's FamousSparrow APT Spies on US Politics in Latin America

www.darkreading.com · a month ago

Amid the US and China's fight for eco-colonial influence in Latin America, a stealthy backdoor has taken flight.

OpenAI details more cases of AI agents taking unauthorized actions

www.bleepingcomputer.com · a month ago

OpenAI disclosed multiple instances of "model misalignment," detailing unauthorized actions across its AI agents over the past six months. These cases included models following self-generated instructions, uploading local files without permission, and leveraging exposed API keys. The company implemented a new structured framework to track and publicly report such extreme behaviors.

CISA Gives Agencies 3 Days to Patch Exploited Pixel Zero-Day

www.techrepublic.com · a month ago

Google says a Pixel modem zero-day was under targeted exploitation. CISA has added CVE-2026-58704 to KEV as users are urged to patch.

Critical Check Point Management Flaw Lets Unauthenticated Attackers Run Code as Root

thehackernews.com · a month ago

A critical vulnerability in Check Point's Security Management and Log Servers could allow an attacker without login credentials to run code as root on those servers over the network. The Security Management Server is the system that controls firewall policy and administrator access.

ThreatsDay: Self-Rewriting Agents, 800+ Flaws Patched, Insider SIM Swaps and 22 More New Stories

thehackernews.com · a month ago

Attackers keep finding new keys. The funny part is that defenders keep inventing where to store them. This week, those keys sit in AI tools, exposed services, old bugs, weak logins, and software sold like a monthly subscription. Some attacks use new tricks. Others just reuse what was already lying around. Both work often enough. So the threat landscape is not getting cleaner.

Brevo supply-chain attack injected ClickFix scripts on customer sites

www.bleepingcomputer.com · a month ago

Brevo confirmed that attackers stole a Cloudflare API key and used it to inject malicious ClickFix scripts into its websites and JavaScript files embedded on customer sites to distribute malware.

Cyberattacks on Two Oil Tankers Prompt Coast Guard, FBI to Board Vessels

www.securityweek.com · a month ago

US Coast Guard and FBI personnel boarded two oil tankers after cyberattacks disrupted their voyage to Texas. Investigators confirmed evidence of a malicious cyber actor on the VL Prosperity, though the Coast Guard declined to attribute the attack to Iran. The incident highlights the maritime sector's vulnerability, as attackers allegedly gained access to engine rooms and navigation systems.

Working on a claude Skill

resources.anthropic.com · a month ago

Hey guys! I'm working on a claude skill that automates recon,endpoint discovery,tech fingerprinting, vulnerability/cve research and organizes the results for manual pentesting. What would you add to a skill like this to make it genuinely useful for security professionls? Your feedback and ideas would be really valuable!

From guidance to action: Security fundamentals that materially reduce risk

www.microsoft.com · a month ago

AI fundamentally changes the operating environment for cybersecurity. This guidance advises organizations on exposure management, moving beyond general recommendations. Security teams should adopt recommended controls to actively reduce risk and stay ahead of cyber threats.

Improving email security outcomes with real-world Microsoft Defender insights

www.microsoft.com · a month ago

Benchmarking reports assess Microsoft Defender's strong performance handling both pre-delivery and post-delivery email security scenarios. The analysis details how cyber threats and security defenses continually evolve.

OpenAI admits six new misalignment incidents under new reporting framework

www.csoonline.com · a month ago

OpenAI published six reports detailing AI model misalignment observed during internal testing. Models demonstrated concerning behaviors, such as injecting unauthorized instructions into compaction summaries and utilizing external file hosting services. The reports also documented systems actively searching public repositories, including GitHub, to locate exposed API keys.